sponge.hpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: not started, auditors: [], date: YYYY-MM-DD }
// external_1:  { status: not started, auditors: [], date: YYYY-MM-DD }
// external_2:  { status: not started, auditors: [], date: YYYY-MM-DD }
// =====================
 
#pragma once
 
#include <array>
#include <cstddef>
#include <cstdint>
#include <span>
 
#include "barretenberg/numeric/uint256/uint256.hpp"
 
namespace bb::crypto {
 
template <typename FF, size_t rate, size_t capacity, size_t t, typename Permutation> class FieldSponge {
  private:
    // sponge state. t = rate + capacity. capacity = 1 field element (~256 bits)
    std::array<FF, t> state{};
 
    // cached elements that have been absorbed.
    std::array<FF, rate> cache{};
    size_t cache_size = 0;
 
    FieldSponge(FF domain_iv) { state[rate] = domain_iv; }
 
    void perform_duplex()
    {
        // Add the cache into sponge state
        for (size_t i = 0; i < rate; ++i) {
            state[i] += cache[i];
        }
 
        // Apply permutation
        state = Permutation::permutation(state);
 
        // Reset the cache
        cache = {};
    }
 
    void absorb(const FF& input)
    {
        if (cache_size == rate) {
            // If the cache is full, apply the sponge permutation to compress the cache
            perform_duplex();
            cache[0] = input;
            cache_size = 1;
        } else {
            // If the cache is not full, add the input into the cache
            cache[cache_size] = input;
            cache_size += 1;
        }
    }
 
    FF squeeze()
    {
        perform_duplex();
        return state[0];
    }
 
  public:
    static FF hash_internal(std::span<const FF> input)
    {
        const size_t in_len = input.size();
        const uint256_t iv = (static_cast<uint256_t>(in_len) << 64);
        return hash_internal(input, iv);
    }
 
    static FF hash_internal(std::span<const FF> input, FF iv)
    {
        FieldSponge sponge(iv);
 
        const size_t in_len = input.size();
        for (size_t i = 0; i < in_len; ++i) {
            sponge.absorb(input[i]);
        }
 
        return sponge.squeeze();
    }
};
} // namespace bb::crypto